README

A secure API authentication package for Laravel using API Key + Secret + HMAC signature with nonce & timestamp validation.
Built for protecting internal or third-party API calls with full management support.

✨ Features

• 🔑 Generate secure API Key & Secret
• 🔐 Validate signature using HMAC
• 🕒 Protects with X-TIMESTAMP and X-NONCE
• 🚫 Revoke or delete API Keys
• 👤 Enforce one key per user
• 📦 Fully tested with PHPUnit 12

📦 Installation (via Packagist)

composer require artapamudaid/secure-api-server

Lalu:

php artisan vendor:publish --tag=config
php artisan migrate

⚙️ Configuration

Konfigurasi berada di config/apikey.php:

return [
    'enabled' => true,
    'timestamp_tolerance' => 300, // in seconds (default 5 minutes)
];

🚀 API Endpoints

🧾 Required Headers for Secured Endpoints

X-API-KEY: {api_key}
X-API-SIGNATURE: {hmac_signature}
X-TIMESTAMP: {unix_timestamp}
X-NONCE: {random_string}

HMAC Signature format:

HMAC_SHA256(api_key . nonce . timestamp, secret)

🧪 Running Tests

composer install
vendor/bin/phpunit

Dibangun menggunakan:

• PHPUnit ^12.0

• Orchestra Testbench (Laravel testing framework)

🛡 Laravel Compatibility